adam/vim
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

patch 9.1.0697: [security]: heap-buffer-overflow in ins_typebuf

Browse Source 
Problem:  heap-buffer-overflow in ins_typebuf
          (SuyueGuo)
Solution: When flushing the typeahead buffer, validate that there
          is enough space left

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt
2024-08-25 21:33:03 +02:00
parent 663950d700
commit 322ba91086
4 changed files with 21 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/getchar.c
View File

@ -446,9 +446,18 @@ flush_buffers(flush_buffers_T flush_typeahead)
if (flush_typeahead == FLUSH_MINIMAL)
{
// remove mapped characters at the start only
typebuf.tb_off += typebuf.tb_maplen;
typebuf.tb_len -= typebuf.tb_maplen;
// remove mapped characters at the start only,
// but only when enough space left in typebuf
if (typebuf.tb_off + typebuf.tb_maplen >= typebuf.tb_buflen)
{
typebuf.tb_off = MAXMAPLEN;
typebuf.tb_len = 0;
}
else
{
typebuf.tb_off += typebuf.tb_maplen;
typebuf.tb_len -= typebuf.tb_maplen;
}
#if defined(FEAT_CLIENTSERVER) || defined(FEAT_EVAL)
if (typebuf.tb_len == 0)
typebuf_was_filled = FALSE;